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(57) Abstract: A control system for calculating control 
commands for actuators in an aircraft, wherein the control 
commands are calculated by computers distributed in the craft 
in dependence on input signals containing parameters that serve 
as the basis for said commands, wherein a computer (C) is 
arranged at each respective local actuator (A) and, together with 
the actuator (A), forms a servo node (S) where the computer (C) 
receives input signals via data bus (B), whereby the computer 
(C) in each servo node (S) calculates control commands for the 
local actuator (A) based on one or more sets of control laws in 
dependence on received parameters, and wherein the computer 
(C) calculates, in a corresponding manner, control commands 
for at least one additional actuator (A) in another servo node (S), 
and wherein a choice of control commands is used as the control 
command (7) for the actuator (A) locally in each servo node (S) in 
dependence on a comparison between the control commands (4) 
calculated locally in the servo node (S) and a control command 
(3) calculated for the actuator (A) in at least one other servo node 
(S) for the actuator (A). 
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Control system for actuators in an aircraft. 
TECHNICAL AREA 

10 The invention concerns a device and a method for creating control commands for actuators in 
an aircraft, whereby the control commands are calculated in dependence on control parameters 
obtained from sensors and distributed to computers, wherein the control commands are 
calculated in accordance with control laws that apply to each actuator. 

15 STATE OF THE ART 

Systems that require control commands are described below, with such a system being 
exemplified by an aircraft. However, this is not a limitation, since the technology is capable of 
use in all types of systems where the same types of problems exist. There are a number of 

20 applications in which redundant computers are used to achieve high reliability in connection 
with the calculation of control commands for aircraft. One such application is found in 
connection with the control system for a modern aircraft, in which a "fly-by-wire" control 
system is used to replace the mechanical systems formerly used. The control commands for 
such a system are generated by means of, e.g. three redundant digital and asynchronous 

25 primary flight computers (channels); see Figure 3. These three primary flight computers 10 are 
centralized to form a unit, the autopilot 11. Each channel has its own set of transmitters. The 
channels can exchange transmitter data via an internal digital link in the autopilot. Each of the 
autopilot channels calculates one control command for each actuator 13, which are in turn 
mechanically connected by a control surface. These commands are voted for in a voter 14 at 

30 each actuator in such a way that if one control command is incorrect, the other two channels 
can together compensate for the error that has arisen. This method, in which more than one 
channel controls one actuator requires that functions for solving the problem of so-called 
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"force fight" be built into the autopilot. 

Communication between the autopilot and transmitters/actuators occurs via analog or digital 

5 point-to-point communication. 

A centralized control system of the type described above comprises a physical unit, the 
autopilot which, should it become disabled (e.g. as a result of damage during combat), causes 
the entire system to stop functioning. The fact that all the computing power is concentrated in 
one processor per channel means that there are no limits on the ways that any programming 

10 error might affect the system. In those cases where signaling between the autopilot and the 
actuators/transmitters occurs by analog means, the task of integrating the various units is 
relatively complex. 

DESCRIPTION OF THE INVENTION 

15 

According to one aspect of the invention, it comprises a control system that supplies actuators 
in an aircraft with control commands, wherein the control commands are calculated in 
computers distributed in the aircraft and in dependence on input signals obtained from sensors 
via a data bus and containing parameters that provide the basis for calculating said commands, 

20 and wherein the system is designed so that one computer is arranged locally at each actuator, 
whereby the computer and its associated actuator form a servo node with a digital interface to 
the data bus. The computer in a servo node calculates the control commands, in accordance 
with control laws stored in the computer, for the local actuator in the servo node, plus the 
control commands for at least one additional actuator in another servo node. Locally at each 

25 actuator, a choice of control commands for the actuator is used as the control command, which 
choice depends on a comparison between the control command calculated locally in the servo 
node and the control command calculated non-locally by a computer in at least one additional 
servo node, which is obtained via the data bus. 
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The actuators can operate in two modes; one mode in which they function normally, i.e. 
assume their commanded positions, and another mode, a so-called "fail-safe" mode which, in 
the case of an aircraft, entails that the actuator permits its control surface to follow the 
5 airstream ("free-winging"). In its normal mode, the actuator will operate as long as a pulse is 
being sent via a special signal. If the pulse disappears, the actuator will switch over to its fail- 
safe mode. 

The servo node computer in each servo node calculates not only the control command for its 

TO own actuator, butalso the control command for one or more other servo nodes. The nori- 
locally calculated control commands are sent via the data bus to the other servo nodes in the 
control system. Each servo node thus receives a number of externally-calculated control 
commands intended for its own actuator. These externally calculated control commands are, 
together with the locally, i.e. internally calculated control command calculated in the servo 

15 node itself, passed through a voter, e.g. a Mid-Level Voter, whereupon one of the control 

commands is selected as the actuator command and consequently used to control the actuator. ... 
This process prevents most single failures from affecting the control surface. The selected, 
transmitted control command and the control command calculated locally in the servo node 
are monitored in a monitoring unit and must, as long as no transient errors occur, be identical. 

20 If they are not, certain types of errors can be identified and rectified, e.g. via so-called double 
execution, i.e. in that each servo node contains a number of sets of control laws, whereby each 
such set produces its own control command via the servo computer. Each set of control laws 
uses its own set of parameters to execute the control commands. The executions of the various 
sets of control laws are separated in time, and occur in such a way that a transient error in, e.g. 

25 the input data will only affect the execution of one set of control laws. Whichever of the 

control laws produces an output signal that agrees with the command sent to the actuator can 
then be considered to be correct since, according to the foregoing rationale, the actuator cannot 
be affected by most single failures. The value of the state variables from the set of control laws 
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that is considered to be correct is then copied to the control lawflaws that calculated an 
incorrect control command, whereupon there are more correct sets of control laws to proceed 
with at the next instance of execution. Another alternative means of rectifying transient errors 
5 is to have just one set of control laws in each servo node but, in the event of an error, to copy 
the value of the state variables from an error-free servo node to the faulty servo node via the 
data bus. 

The servo node also internally monitors its own function with the help of, e.g. a so-called 
1.0 "Watch Dog Monitor" or WDM, in a known manner. The function of the actuator is monitored 

by means of, e.g. a model monitor. If a fault is detected by the internal monitoring or at the 
. actuator by the model monitor, the actuator will be commanded to assume its fail-safe mode in 

that a pulse will no longer be sent to the actuator. If a serious fault occurs in the servo node,, 

computer or electronics, the node will be unable to deliver any pulse, whereupon the actuator 
15 will again be switched. to its fail-safe mode. 

The advantages achieved using a control system according to the invention consist in that: 
higher damage tolerance is achieved, since there is no central and thus critical unit; 
maintenance costs will be lower, in that a complex central unit is replaced by multiple 
20 simpler and mutually interchangeable devices; 

troubleshooting, fault-localization and integration of the control system units are 
simplified, since the servo nodes have only digital interfaces with the rest of the 
system. 

25 FIGURE DESCRIPTION 



Figure 1 shows a servo node in a control system according to the invention, and its connection 
to the control system data bus. The figure is merely a functional depiction, and does not give a 
physical description of the servo node. 
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Figure 2 provides an overview of the structure of a control system with distributed computers 
according to the invention, i.e. one computer function for each actuator. 

5 

Figure 3 illustrates a control system according to the prior art with three primary control 
computers arranged centrally, and wherein the computers are arranged in parallel for 
redundancy. 

- - 10 DESCRIPTION OF EMBODIMENTS 

A number of embodiments of the invention are described below with reference to the 
accompanying figures. . 

15 Figure 2 provides an overview of a number of actuators A distributed throughout an aircraft. 
The actuators A have the purpose of executing a control maneuver, such as actuating a valve 
or controlling an engine, an electrical machine, a relay, a rudder surface or some other 
corresponding actuatable device. The actuators A are controlled by means of computers C, 
which are deployed in servo nodes (S). Each computer C contains stored control laws for 

20 calculating control commands for the actuator A in the servo node node (S) to which said 
computer belongs, and for at least one additional actuator A in another servo node (S). The 
control of the actuator A is determined by parameters that are obtained via sensors G in the 
system. The sensors G can consist of miscellaneous data transmitters such as speed indicators, 
temperature gages, pressure gages, steering controls, etc. The aforesaid sensor parameters are 

25 digitally transmitted as data via a data bus B, whereby all the servo nodes (S) in the system 
have access to exactly the same sensor data. The computer C in each servo node (S) can thus 
calculate, based on received sensor data, a control command for the actuator A in its own 
servo node and for at least one actuator A in another servo node (S), based on control laws 
programmed into the computer C. 
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A servo node in the control system is described separately in Figure 1, where the servo node 
contains a computer C that is connected to the actuator A. All sensor data (2) are sent to the 
computer C via the data bus B. These data are used by the control laws F to calculate at least 

5 two local control commands (4) according to the double-execution principle, or just one 

control command (4) in the event that double-execution is no longer intended to be used. One 
control command (1) is calculated for at least one additional actuator in another servo node 
(S). The control command/commands (4) calculated locally by the servo node for itself is/are 
voted on together with a number of non-locally calculated control commands (3) for its 

10 actuator A in a voter H, e.g. a "Mid-Level- Voter". The resulting control command (7) is used 
to control the actuator A. The selected actuator command (7) and the local control 
command/commands (4) are monitored by a monitoring function I. If the locally calculated 
control command/commands (4) do not agree perfectly with the actuator command (7), one of 
the following actions is carried out: 

15 

- If double-execution is used: determine which of the local control commands (4) is correct. 
The state variables for the set of control laws for the correct control command are copied to 
the sets of control laws that calculated an incorrect control command. 

20 - If double-execution is not used: the state variables are copied from a correctly functioning 
servo node (S) to the malfunctioning servo node (S) via the data bus. 
In either case, the correct local control command/commands (4) is/are obtained at the next 
point of execution, assuming that no transient faults occur. If, for any reason, it is not possible 
to cope with the transient fault, the non-locally calculated control commands (3) may, as a fust 

25 option, be used to control the actuator A. If this is not possible either, the actuator A will be 
put into its fail-safe mode in that the pulsed signal will cease. The monitoring function I will 
then also stop sending the pulsed signal (8) if the internal monitoring function W in the 
computer has detected any faults. The internal monitoring function W is designed in such a 
way that it has a high probability of being able to detect if the computer C is not functioning in 
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the intended way; such monitoring can be realized by using a "Watch-Dog-Monitor" in a 
known manner. The monitoring function I also stops sending the pulsed signal (8) if the 
actuator monitoring function J detects that the actuator is not behaving in the expected way; 
this an be realized via a so-called "model monitor" in a known manner, based on the actuator 
commands and certain parameters from the actuator (9). 

Other servo nodes (S) in the control system function in the manner described above. The 
signals that are mediated to the respective servo computers are digital. The various servo 
nodes (S) work in synchrony. 
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CLAIMS 

1 . A control system for calculating control commands for actuators in an aircraft* 
whereby the control commands are calculated by computers distributed in the aircraft 
in dependence on input signals from sensors (6) that detect control parameters for the 
control system, which computers are arranged to receive input signals via a data bus 
(B) and calculate control commands for a first actuator (A) and for at least one 
additional actuator in dependence on received control parameters, whereupon an 
executive control command for each respective actuator is arranged to be selected and 
transferred to the respective actuator, characterized in that 

- a computer (C) is placed at a respective first actuator (A) and, together with the 
actuator (A), forms a servo node (S) with a digital interface with the data bus, 

- the computer (C) in each servo node is arranged to receive, via the data bus, control 
commands for the actuator (A) determined by a computer in at least one additional 
servo node (S), 

- the computer (C) in each servo node (S) is arranged to select the executive control 
command for the actuator (A) in the servo node in dependence on a comparison 
between the control commands (4) calculated locally in the servo node (S) and the 
control commands received via the data bus, 

- the computer (C) is arranged to transfer the executive control command to the 
actuator in the servo node. 

2. A control system according to claim 1, characterized in that a computer (C) in the 
servo node (S) contains programs with control laws for calculating control commands 
for the actuator (A) in its own servo node, plus control laws for calculating control 
commands for actuators (A) in at least one other servo node (S). 

3. A control system according to claim 2, characterized in that each servo node (S) 
contains a voting function for calculating an executive control command (7) for the 
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actuator (A) based on both the control commands calculated locally in the servo node 
itself and on control commands calculated in at least one other servo node (S). 

4. A control system according to claim 3, characterized in that a monitoring function (I) 
in the servo node (S) receives the executive control command (7) and the locally 
calculated control commands (4) and compares these control commands, which must 
be identical. 

5. A control system according to claim 4, characterized in that, as long as no fault is 
present, the monitoring unit (I) transmits a pulsed control signal (8) to the actuator (A), 
whereupon the pulsed control signal (8) must be present at the actuator in order for a 
control command to be executable, so that if the pulsed control signal ceases, the 
actuator will be set to its fail-safe mode. 

6. A control. system according to claim 5, characterized in that the computer (C) in a 
servo node (S) contains an internal monitoring function (W) that monitors the 
computer functionality and, in the event of a fault, sends information (5) to the 
monitoring unit (I), whereupon the pulsed control signal (8) is not transmitted, which 
causes the actuator to be set to its fail-safe mode, 

7. A control system according to claim 6, characterized in that the function of the 
actuator (A) is monitored by a model monitor (J) that detects any malfunction of the 
actuator (A), whereby the monitoring unit (I) obtains information (6) about the fault, 
whereupon the pulsed signal is terminated and the actuator is set to its fail-safe mode. 

8. A control system according to claim 1 , characterized in that the computer (C) 
contains multiple sets of control laws and compares the control commands (4) 
calculated in locally in the servo node (S) via double-execution with the actuator 
command (7) selected by voting, whereupon, in the event that the commands are not 
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exactly identical, the control commands (3) calculated in at least one other servo node 
(S) are used to determine which of the locally calculated control commands is correct. 

9. A control system according to claim 8, characterized in that the values of the state 
parameters in the control laws that produced the correct local control command are 
copied to the set of control laws that failed to produce a correct control command. 

10. A control system according to claim 1, characterized in that the computer (C) 
contains a set of control laws and compares the control command (4) calculated locally 
in the servo node (S) with the actuator command (7) selected by voting, whereupon, in 
the event that the commands are not exactly identical, the value of the suite parameters 
of the control laws in a fault-free servo node (S) is copied to the state parameters in the 
control laws in the faulty servo node (S). 

11. A control system according to claim 1 , characterized in that the control system 
signals are exclusively digital in nature, and in that the signals in the system are 
mediated via a data bus (B). 

12. A control system according to claim 1 1, characterized in that the data bus (B) is a 
logical "broadcast" bus or a star-configured bus. 

13. A control system according to claim 1 , characterized in that the servo nodes (S) in 
the control system work in synchrony. 

14. A control system according to claim 2, characterized in that the control system is 
used in an airplane, in that the sensors (G) contain gyros for detecting roll rate as well 
as speed indicators, and in that the actuators (A) are used to operate control surfaces. 
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